7179 2015-01-19 07:53:12 +0000 kernel: VDSO randomization not very random CVE-2014-9585 2015-02-17 21:09:22 +0000 1 1 7 Build System, Metadata & Runtime OE-Core kernel unspecified x86 Multiple RESOLVED FIXED Medium normal 1.8 1 sona.sarmadi bruce.ashfield bruce.ashfield tom.zanussi --- --- No (bug/feature does not impact docs) oldest_to_newest 48020 0 sona.sarmadi 2015-01-19 07:53:12 +0000 The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD. The fix can be found here: https://git.kernel.org/cgit/linux/kernel/git/luto/linux.git/commit/?h=x86/vdso&id=bc3b94c31d65e761ddfe150d02932c65971b74e2 http://marc.info/?l=linux-kernel&m=141909723019695&w=2 References: https://bugzilla.kernel.org/show_bug.cgi?id=89591 https://security-tracker.debian.org/tracker/CVE-2014-9585 48190 1 bruce.ashfield 2015-01-22 15:48:01 +0000 I have -stable updates for 3.10, 3.14 and 3.17 that will address this. And then we'll remove 3.17, to make it a non-issue for the newest kernels.